From 2c34a7da87d7c785f0f694bc2aceb1fd09d2516d Mon Sep 17 00:00:00 2001
From: 0xchainer <109617724+0xchainer@users.noreply.github.com>
Date: Sat, 23 May 2026 22:26:49 +0300
Subject: [PATCH] fix(cli): prevent temp directory leak on ZIP update failure

Move shutil.rmtree into a finally block so the temp directory is always
cleaned up, even when an exception occurs during download, extraction,
or file copying.
---
 hermes_cli/main.py | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/hermes_cli/main.py b/hermes_cli/main.py
index 27d24f7eb63..dbd80b5d407 100644
--- a/hermes_cli/main.py
+++ b/hermes_cli/main.py
@@ -6932,8 +6932,8 @@ def _update_via_zip(args):
     )
 
     print("→ Downloading latest version...")
+    tmp_dir = tempfile.mkdtemp(prefix="hermes-update-")
     try:
-        tmp_dir = tempfile.mkdtemp(prefix="hermes-update-")
         zip_path = os.path.join(tmp_dir, f"hermes-agent-{branch}.zip")
         urlretrieve(zip_url, zip_path)
 
@@ -6980,12 +6980,11 @@ def _update_via_zip(args):
 
         print(f"✓ Updated {update_count} items from ZIP")
 
-        # Cleanup
-        shutil.rmtree(tmp_dir, ignore_errors=True)
-
     except Exception as e:
         print(f"✗ ZIP update failed: {e}")
         sys.exit(1)
+    finally:
+        shutil.rmtree(tmp_dir, ignore_errors=True)
 
     # Clear stale bytecode after ZIP extraction
     removed = _clear_bytecode_cache(PROJECT_ROOT)